Not switched on
Many providers publish the key but you still have to click Start authentication.
Tools · 30 seconds
DKIM checker
Find a domain’s DKIM keys, by your selector or 36 common ones, and see whether the key is strong enough.
Runs in your browser · public DNS records only · nothing stored
What DKIM does
DKIM signs every email with a private key held by your email provider. The matching public key sits in DNS under a selector, at selector._domainkey.yourdomain. The receiving server uses it to check the signature.
Each tool that sends as you needs its own DKIM set up. Your mailbox provider signing is not enough if your newsletter or sequencing tool sends unsigned.
How to find your DKIM selector
- SendSend an email from the tool you want to check to a Gmail address.
- OpenIn Gmail, open it, click the three dots, then Show original.
- FindIn the DKIM-Signature line, find s=. That value is the selector, and d= is the signing domain.
- CheckEnter the selector above. The result shows the key type and length.
DKIM selectors by provider
| Provider | Selector | Note |
|---|---|---|
Google Workspace | google | Set in Admin console, Gmail, Authenticate email. |
Microsoft 365 | selector1, selector2 | CNAME records that point to Microsoft. |
Mailchimp | k2, k3 | CNAME records from the domain settings. |
SendGrid | s1, s2 | CNAME records from sender authentication. |
HubSpot | hs1-…, hs2-… | Include your account number, so enter them as shown in HubSpot. |
Others | Check the header | Open a sent email, show original, read s= in DKIM-Signature. |
Common DKIM problems
1024-bit key
Still accepted, but 2048-bit is the recommended minimum. Rotate in your provider.
Empty p= value
The key is revoked and signatures fail. Publish a new key.
t=y left in
Testing mode. Remove it once signing works.
Signed with the provider’s domain
d= shows the tool’s domain, not yours, so DMARC alignment fails. Set up custom DKIM in the tool.
Gmail and Yahoo sender rules
What inbox providers require since February 2024
Bulk senders send about 5,000 or more emails a day to Gmail. Cold email teams reach that quickly across mailboxes, so treat the bulk rules as the standard.
Source: Google email sender guidelines
| Rule | Who | Requirement |
|---|---|---|
| SPF or DKIM | All senders | Required |
| SPF and DKIM | Bulk senders | Required |
| DMARC, p=none or stronger | Bulk senders | Required |
| From domain aligned with SPF or DKIM | Bulk senders | Required |
| One-click unsubscribe | Bulk senders, marketing email | Required |
| Spam complaint rate | All senders | Below 0.3 percent |
Questions people ask
Why does the checker say DKIM was not found?
DKIM keys sit under a selector your provider chooses, and there is no public list of them. The checker tries 36 common selectors. If yours is different, find s= in an email header and enter it.
Is a 1024-bit DKIM key safe?
It still passes, but 2048-bit is the recommended minimum today, and Google Workspace recommends it. Rotate when you can.
Do I need DKIM if I have SPF?
Yes. SPF breaks when email is forwarded; DKIM survives it. Google and Yahoo require both from bulk senders.
Can I have several DKIM keys?
Yes. Each sending tool uses its own selector, so one domain often has several keys.
Is my domain stored?
No. The check runs in your browser. Your browser asks Cloudflare’s public DNS service (or Google’s, as a fallback) for the domain’s public records, the same records every mail server reads. RevOps Lab does not receive or store the domain or the result.